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Recent work has shown how to use the laws of quantum mechanics to keep classical 
and quantum bits secret in a number of different circumstances. Among the examples are 
private quantum channels, quantum secret sharing and quantum data hiding. In this paper 
we show that a method for keeping two classical bits hidden in any such scenario can be 
used to construct a method for keeping one quantum bit hidden, and vice-versa. In the 
realm of quantum data hiding, this allows us to construct bipartite and multipartite hiding 
schemes for qubits from the previously known constructions for hiding bits. Our method 
also gives a simple proof that two bits of shared randomness are required to construct a 
private quantum channel hiding one qubit. 
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Dedication to David Mermin 

It is a pleasure to have an opportunity to include our work in this tribute to our friend David Mermin. 
We hope that he will enjoy it, as it is a brand new result flowing from the teleportation/dense coding 
mindset that has been so fantastically productive in quantum information theory over the past few years. 
As the now-admitted midwife of teleportation, he will recognize the usual elements (the ensemble ofPauli 
rotations, the one-qubit-gets-you-two-bits-and-vice-versa structure) of these kinds of arguments, twisted 
though they may be in the service of some new cryptographic application. It seems that the metamorphosis of 
the teleportation game of 1993 into a myriad of different serious constructions in the service of cryptography, 
secure and fault tolerant computation, and communication complexity has not yet come to an end. We are 
grateful to David Mermin for helping set this process in motion, and for continuing to observe the resulting 
flowering with a generous, interested, and critical eye. 

I. INTRODUCTION 



Work in recent years has shown how to use the laws of quantum mechanics to keep classi- 
cal and quantum bits secret in a number of different circumstances. In some scenarios, the bits 
are kept secret from an eavesdropper while in others, they are kept secret from the participants 
themselves. Perhaps the simplest such example is the quantum generalization of the one-time 
pad, known as a private quantum channel |^. In this setting, two parties make use of shared 
random bits to create a secure quantum channel between them. In this case, the message is kept 
secret from an eavesdropper with access to the output of the quantum channel. In contrast, the 
goal in quantum secret sharing [^] is to share a secret, in the form of classical or quantum bits, be- 
tween many parties. Certain prescribed combinations of the parties, known as authorized sets, are 
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capable of fully reconstructing the secret using quantum communication while the other unau- 
thorized combinations of parties can learn nothing at all about the secret, even if they act jointly 
on their shares. A third example, which will be the focus of this paper, is known as quantum data 
hiding. This task, introduced in Refs. ^ for the bipartite setting and generalized to multiple 
parties in Ref. [^], imposes a stronger security criterion than quantum secret sharing. Whereas 
in quantum secret sharing an authorized set may be able to extract information about the secret 
by performing local operations in addition to classical communication, in quantum data hiding 
the authorized set needs to communicate quantum data in order to get substantive information 
about the secret. So in quantum data hiding one allows all parties to communicate classical data 
to one another in an effort to reveal the secret. Quantum communication within an unauthorized 
set, supplemented with classical communication between all parties, reveals nothing. (Or, rather, 
next to nothing; one of the results of Ref. is that perfect quantum data hiding is impossible.) 

The main result of this paper is the first construction of quantum data hiding protocols for 
hiding qubits; the protocols of Refs. [^] and only work for hiding classical bits. Our method 
is to build on top of the earlier work, converting any method for hiding 2n bits into a method for 
hiding n qubits. For symmetry, we will also demonstrate how any n-qubit data hiding scheme can 
be converted into a 2n-bit hiding scheme. The cormection, which is closely related to the duality 
between superdense coding [^] and teleportation [^], is largely independent of the setting of the 
problem. Indeed, the basic idea, as sketched in Fig. |l|, can actually be applied just as well to the 
private quantum charmel and quantum secret sharing as to quantum data hiding. 

We begin section || by defining bipartite data hiding and describing the method for converting 
between bit and qubit hiding schemes. In sections [LA and IIB we provide security proofs for the 
resulting schemes under the idealized assumption that the original schemes were perfectly secure 
before relaxing to approximate hiding in sections II C and II D, The additional complications that 
arise in multipartite hiding are dealt with in section ID, where our main result is that the only 
constraints on the authorized sets are the same as those for quantum secret sharing [^. Section 
^/\ demonstrates how the duality imposes limits on the resources required for hiding. As an 
application, we provide a simple, conceptual proof that 2n bits of shared key are required for an 
n-qubit private quantum channel. 

As the reader has probably already noticed, the term quantum data hiding refers to the methods 
used rather than the data stored. Rather than resorting to contorted phrases like 'quantum hiding 
of quantum data', we will henceforth omit the first 'quantum' and refer to qubit-hiding schemes or 
bit-hiding schemes. Hopefully, this will simultaneously keep both confusion and redundancy to a 
minimum. In this paper we will denote the density operator corresponding to a pure state | (p) as 99. 
The phrase 'Trace-preserving Completely Positive map' will be abbreviated to 'TCP map'. A TCP 
map that can be implemented by Local Operations supplemented by Classical Communication is 
called an LOCC map or operation. The trace norm ||^||i of an operator A is defined as 



II. BIPARTITE HIDING 

Formalizing the description of data hiding used in the introduction, we define an n-bit data 
hiding scheme for two parties Alice (A) and Bob (B) to consist simply of a set of orthogonal bipar- 
tite hiding states {pf^}, where / = iii2 ... in is an n-bit string. Since these states are orthogonal, 
we can define a physical encoding map Ec{\I){I\) = pi- The orthogonality condition guarantees 
that, if allowed quantum communication, Alice and Bob can perfectly recover / by some decoding 
operations D. The scheme is said to be perfectly secure if Alice and Bob are incapable of learning 
anything using only LOCC operations. Equivalently, the scheme is perfectly secure if, for all /, J 
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FIG. 1: Conversion between classical and quantum hiding schemes: A. Using the classical hiding scheme Ec 
via teleportation to get a quantum hiding scheme. B. Using the quantum hiding scheme Eq via superdense 
coding to get a classical hiding scheme. Double lines denote classical data and solid lines multi-qubit 
quantum data. The gate a applies a (tensor product) of Pauli operations as a controlled unitary. Bell M 
denotes a Bell measurement jsj. Note that in the 'teleportation' circuit in A, the corrective Pauli operations 
are omitted. 



and LOCC operations L, 

TiaL{pi) = TtaL{pj). (1) 

As noted in the introduction, this perfect security is not actually possible. We say that the scheme 
is e-secure if, for all /, J and LOCC operations L, 

\\TrALipi)-TrALipj)h<e. (2) 

If e = this definition reduces to perfect security. 

Extending this approach to the case of quantum data, we say that a bipartite n-qubit hiding 
scheme consists of an encoding map Eg taking n-qubit states to bipartite hiding states Eq{ip) on 
AB such that there exists a TCP decoding map D satisfying D{Eq{ip)) = if for all ip. The scheme 
is 5-secure if for all (po and pi as well as LOCC operations L, 

\\TtAL{Eq{po)) - TtAL{Eg{pimi < 5. (3) 

Henceforth we will restrict our attention to pure state inputs po and pi . This is sufficient because 
the convexity of the trace norm ensures that the most distinguishable states will always be pure. 
For the rest of the paper, we will also impose the additional requirement that the map Eq cor- 
respond to a physical operation, meaning that it will be TCP. For the qubit-hiding schemes we 
construct, the condition will be satisfied automatically. When we attempt to construct bit hiding 
schemes from qubit-hiding schemes however, our method would fail without the extra condition. 

Now we are ready to explain how to construct secure hiding schemes for sets of n qubits 
starting from secure hiding schemes for 2n classical bits. 

Assume we have a classical hiding scheme for 2n bits with encoding map E^- The hiding states 
are pi, where / = iii2 • • • is a string of length n, each position taking an integer value between 
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and 3. Let be an n-qubit state. We define a TCP encoding map Eg by 

where cr/ = o-j^ cTjj • • • o-j^ is a tensor product of Pauli operators, adopting the convention 
that do = I- It is clear that if pi are a set of orthogonal states, there exists a decoding operation 
D such that D o Eq{(p) = ip. Notice that Bob's register is divided into two parts, the first storing 
his half of the bit-hiding states pj and the second a Pauli-conjugated version of ip. Equivalently, a 
more operational way of thinking about Eq{(f) is as the output of the circuit illustrated in Fig. QA. 

Using a dual construction, any perfectly secure n-qubit hiding scheme can be used to build a 
perfectly secure 2n-bit hiding scheme. Let Eg be some TCP encoding map, not necessarily of the 
form of Eq. hiding states of an n qubit register Bi on a bipartite system ABi . (We will assume 
without loss of generality when discussing this 'superdense coding scheme' that the initial state 
is stored on Bob's system.) Our method of hiding 2n classical bits combines the quantum hiding 
scheme and superdense coding, see Fig. |l|B. Let 

l$,)^l^2 = (a,®IB,)|$)^^^^ (5) 

where |<I>)^i^2 — 2~"/2 Yl'k=i 1^)^^ |^)^^ is a maximally entangled state between the registers Bi 
and B2. We define the hiding states for the classical bits to be 

pi = {EgcsiB,)i'^f'''n- (6) 

Since Eg is a qubit-hiding scheme there exists a decoding operation D such that D o Eg = I. This 
implies that the classical hiding states pi are orthogonal since they can be mapped by an operation 
Z) (g) I onto the orthogonal states 

In the next few sections we will prove the security of a qubit hiding scheme from the security 
of the bit-hiding scheme and vice-versa. 

A. Perfect Hiding: Classical — > Quantum 

Our goal is to show that if the pi are perfectly secure 2n-bit hiding states then the states Eg{ip), 
defined in Eq. are, likewise, perfectly secure n-qubit hiding states. By construction, some 
simple-minded approaches to cheating by Alice and Bob will fail to yield any information about ip. 
First, because the reduced state on the B2 register is always maximally mixed, no measurement by 
Bob on B2 alone will yield any information about the input state. Similarly, since the ABi register 
starts independent of 99, any LOCC protocol applied to it alone will have output independent of 
if. Moreover, since the pi form a set of perfect hiding states, Bob's final reduced density operator 
on Bi will be independent of / so he can't learn anything that would help him to undo the I- 
dependent Pauli rotations on B2. This doesn't prove security, however. It is conceivable that by 
acting on Bi and B2 together in an LOCC protocol that Bob might be able cheat by a strategy we 
haven't yet considered. We now give a formal proof that this is not possible. 

Suppose, on the contrary, that the proposed n-qubit hiding scheme is not secure against arbi- 
trary LOCC cheating. That is, there is a choice of input states ipQ and ipi and an LOCC operation 
L such that 

TrAL{Eg{p>Q)) / TrAL{Eg{ipi)). (7) 

In words, Bob's output density operator at the end of the LOCC protocol depends on the input 
state, meaning that he can perform a local measurement that will distinguish to some degree 
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between inputs ip^ and ipi. Our goal in what follows will be to prove that if this were true, the pi 
could not be perfect hiding states. 

For convenience, we'll adopt the more compact notation C = Tta ° L. We can then introduce 
the operations 

Cj{T^'')=C{pf^(^JT^^) (8) 

which represent the action of the LOCC operation C given a particular value of the hiding state 
pi. Note that £/, while it is TCP, is not necessarily itself an LOCC operation because it involves the 
preparation of a potentially entangled ancilla p^^^ . We can then write 

/:(i?,M) = ^^£,(a,(^a,) (9) 

for the output of the 'cheating' operation on an n-qubit hiding state. From this identity, we can 
conclude that not all the £/ are identical to Cq, however; if they were, then by linearity. 




would be independent of the input state tp, violating Eq. (^. 

The non-constancy of the £/ can then be converted into a method for breaking the 2n-bit hiding 
scheme. Supplied with a state p^^^ from which they would like to learn about /, Alice and Bob 
implement the following LOCC protocol. First, Bob prepares a maximally entangled state 

|<J>)^^^3= 1 |^|fc)B.|^^iJ3 (11) 
k=l 

between two local registers B2 and ,63. Alice and Bob then together apply the LOCC operation 
£ ® to the state pj ^^^Bs^ resulting in the outcome (£/ Ibs){^) on Bob's system alone. 
By the Jamiolkowski isomorphism between operations and states [|l^], the non-constancy of the 
Cj implies that the outcome cannot be independent of /. Hence, Bob can perform a local measure- 
ment whose outcome will be /-dependent and the 2n bit hiding scheme based on the pi cannot 
be secure. 



B. Perfect Hiding: Quantum Classical 

Consider the definition of the bit-hiding states in Eq. (^). Because we can choose an operator 
basis consisting of density operators rj, there is an expansion 

JK 

of the projector for the maximally entangled state in terms of density operators for product states. 
(The ajK, of course, will not all be positive.) 

Now let's try cheating on our 2n-bit hiding scheme. If £ = Tr^i o L is again an LOCC operation 
with output on Bob's system, then substituting Eq. ( [T^ into @ shows that 

C{pj) = C{{E,0lB,){<^f 

= ajKC{E,{aiTjai)^''' ® r^^). (13) 

JK 
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The operation of first preparing tk on B2 and then applying C is itself LOCC so by the perfect 
security of the n-qubit hiding scheme, we can conclude that C{Eq{aiTjai)^^^ ® r^^) is indepen- 
dent of ajTjaj for all / and J. Consequently, C{pi) is independent of /, meaning that the 2n-bit 
hiding scheme is perfectly secure. 



C. Imperfect Hiding: Classical Quantum 

As was shown in Ref. while a bit-hiding scheme can be made e-secure for all e > 0, perfect 
security is not possible. So, we need to investigate whether a nearly secure bit-hiding scheme 
leads to a nearly secure qubit-hiding scheme. We show that an e-secure 2n-bit hiding scheme can 
be converted into a J-secure n-qubit hiding scheme, for 6 = e2"+^. The exponential factor 2""*"^, 
while undesirable, needn't cause practical difficulties: for the bit-hiding schemes presented in 
Refs. and e decreases exponentially with the size of the hiding state. Therefore, the factor 
2»i+i can be suppressed at a cost of increasing the size of the hiding state by a factor polynomial 
in n. Furthermore, it could very well be that the estimates we present here are not tight and that 
the factor is only an artifact of our analysis. In any case, the idea behind the proof of security is 
the same as in the perfect case but the details, unfortunately, become significantly more technical. 
So as not to repeat ourselves, we will adopt the notation of section II A| . 



In the perfect case, we proceeded by making a connection between the behavior oi C o Eq and 
(£/ Ibz){'^^'^^^)- Name this last operator ujj and introduce A/ = cj/ — ujq. Recall also that the 
encoding operation Eq takes B2, an n-qubit system, to AB1B2 while the LOCC C takes AB1B2 to 
a Bob-only system. Since we don't want to make any assumptions yet about it's structure, we will 
call this system Bj. We define the state 

The state can be related to the action of the map C o Eq on a state ip by the identity 

(/p = 2"TV2((I®(/7*)$i2), (15) 

where cp* is the complex conjugate of the density matrix of ip and the numbers 1 and 2 are general 
system labels. Now, as in the perfect hiding case, assume that the n-qubit hiding scheme is not 
5-secure, meaning that there exist states ipo and ipi such that 

6<\\{CoEq){ipo)-{CoEq){ipi)\\,. (16) 

Using the identity in Eq. (|^) and the definition of ^, we find that 

6 < 2"||TrB3(I®^S)e^^^^-TrB3(l0¥'De''^''^lli- (17) 
In order to relate 6 to Aj, we rewrite ^ in the following manner: 

I 

= Ttb.ujo ^ ^Ib3 + ^ JZO^Bf ^ (Jl)Al{lBf (Tl), (18) 
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where we have used the fact that (I = ^ When inserting this in Eq. ( [17D we 

observe that the term involving Tr^gWo ^Isg makes no contribution so we need only keep the 
sum over (I (j/)A/(I ® cj/). In the following derivation we will need the inequality 

ll^^lli < ll^lli> (19) 

where P is a projector. This can be proved as follows. Let Ai > A2 > • • • be the singular values of 
A. Let P be a /c-dimensional projector. We have 

k 

\\PA\\i = maxTiiPAU) < maxTr(Q^f/) = ^ < ||^||i, (20) 
U U,Q 

where we used that Q is /c-dimensional projector. 

We insert the result of Eq. ( [T^ in Eq. ( |T^ and apply Eq. (19), the monotonicity imder partial 
trace and subadditivity of the trace norm to find 

I 

Reading this inequality as an average over the 2^" possible values of /, there must exist a partic- 
ular choice for / for which — liJ/=o||i = ||A/||i > 5/2"+^. As in the perfect hiding argument, 
this provides a cheating operation for the classical scheme that will distinguish the hiding states 
of the particular / and / = 0. The classical scheme, therefore, cannot be 5/2"+^ -secure. 



+ 2'^ 



D. Imperfect Hiding: Quantum Classical 

We suppose that there is some quantum hiding scheme Eg that is (5-secure, i.e. for all pairs of 
quantum states ipo and ipi and LOCC operations C we have 

\\{CoEg){^o)-{CoEg){ip,)\\i<6. (22) 

^From this we will deduce the quality of the derived bit-hiding scheme, that is, we study 

\\C{pj) - C{pj)h, (23) 

where pi and pj are given in Eq. (^). We will use an explicit operator expansion of the maximally 
entangled projector Eq. [|, Eq. (24)]: 

4"-l 

^ = ^T.{-lf^''^<rM^<rM. (24) 

M=0 

Here iV(ll) counts the number of ay operators in the product cja/. Note also that ctm, for any M, 
has 2"^^ positive eigenvalues (A = +1), and the same number of negative eigenvalues ( A = — 1); 
therefore, it can be written as the difference of two density operators using 

aM = 2"-i(pf -p^^), (25) 
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where are separable. In the following, we will use the shorthand ajMi = o'laMO'i, and p^j^^ 
ajp^aj. With all this, we can write for Eq. (Q: 



WCipi) - c{pj) 



< 



\\c{{E,®iB,mi){^i\-\^j){^j\))\\^ 

^ ^(-1)^(11) [C{Eq{aiMi) ® tm) - C{Eg{ajMj) ® tm)] 

M 

^ \\C{Eg{aiMi) «> (Tm)\\^ + \\CiEq{ajMj) ® aM% 



M 



M 

9 92(n-l) 

' ' --y:\\c{E,{pf^^)^p^) 

M 



< 



4n ^ 
KMK 



i^{E,{p: 



KMK\ 



C{Eq{p—)®p 
<lmax5;||£(i?,(pr^ 



M 



|max^ \\C{Eq{p 



KMK\ 



II 

KMK\ 



M 



2 K 
< — max max 1 1 



<S)p 



+ 



ll 



KMK\ 



4" 



max max ||£(£'q(/9 



M 



KMK\ 



- C{E,{pi 



<8)p-. 
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An 

< -{26) = 4-5. 



(26) 



In the last inequality, we used the fact that p^ are separable density matrices, independent of K, 
which implies that Alice and Bob can prepare them by LOCC operations. Thus to distinguish, 
say, E^{p^^'^^) ® pf from Eg{p^^^^) ® pf by LOCC should not be easier then to distinguish 
*^^) from Eg{p^^^) by LOCC, for which the distinguishability is bounded as in Eq. (H). 
So, we get a bound on the quality of the bit-hiding scheme, although one suffering the same 
exponential deficiency as the bound of section pC . 



III. MULTIPARTY HIDING & QUANTUM SECRET SHARING 



We now consider the task of hiding quantum data in a multiparty setting. Generalizations 
of bipartite bit-hiding schemes to multipartite situations have been developed by Eggeling and 
Werner [^]. Unfortunately, there is a problem with combining these bit-hiding schemes with the 
qubit-hiding construction of Eq. (|): the qubit-hiding scheme places the hidden quantum state 
entirely in the possession of a single party since register B2 belongs to Bob. In the direct general- 
ization of the scheme to the multiparty setting, the privileged holder of the hidden quantum state 
would, therefore, necessarily have to be a member of every authorized set. This would eliminate 
the possibility of threshold schemes, for example, in which any sufficiently large subset of the 
parties should be able reconstruct the secret. The solution is to hide distributed quantum data, 
using quantum error correcting codes to share the hidden quantum state between the parties in a 
more symmetrical fashion. 

An application involving such distributed hiding has been considered in the literature: quan- 
tum secret sharing [^]. In quantum secret sharing, the identity of a distributed quantum state. 
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held by a set of parties, is unobtainable by these parties if they do only local operations. There 
are authorized sets of parties who, with quantum communication among each other, can recon- 
struct (i.e., put the full state in the possession of any single party) the quantum state, and there are 
unauthorized sets, for whom no reconstruction is possible even with quantum communication. 
Such quantum secret sharing schemes are implementable with quantum error correcting codes; 
for example, there is a five-qubit error correcting code for which any three out of the five parties 
constitute an authorized set, while any set of two is unauthorized. With such error correction 
codes, quantum secret sharing schemes with any "access structure" are realizable. This access 
structure need only be consistent with monotonicity and the quantum no-cloning theorem, mean- 
ing that any superset of an authorized set is authorized, and the complement of an authorized set 
is unauthorized [^. 

The capabilities of quantum secret sharing can be strengthened by the techniques of this pa- 
per. The quantum secret sharing protocol does not specify the status of the secret if the parties 
can perform LOCC operations, rather than just local operations. In fact, for the implementation 
of quantum secret sharing using quantum error correcting codes, LOCC operations between the 
parties can, and often do, result in the parties obtaining partial information about the secret. How- 
ever, by wrapping the quantum state of quantum secret sharing inside a multipartite version of 
our qubit-hiding protocol, we can guarantee that the quantum secret is impervious to attack by 
LOCC operations of the parties; we illustrate the idea in Fig. ^ This requires some generalization 
of the protocol given above, and of its security analysis. 

O 



\ I 
\ I 
\ I 
\ I 





FIG. 2: If five parties each have shares of a state in a five-qubit error correcting code, then the identity of 
the state cannot be obtained by two parties in quantum communication . But if aU parties are in addition 
in classical communication with one another (dotted lines), then the parties can obtain some information 
about the state. If, however, the secret-sharing state is encoded using a bit-hiding state holding 2x5 bits 
(Eq. (^)), then the parties can obtain only a negligible amount of information about the hidden quantum 
state. 



Suppose we have a p-party quantum secret sharing state 99, and that k qubits distributed 
among these parties are sufficient to hold this state. (For quantum secret sharing schemes, k 
is polynomially related to the number of logical qubits n that can be hidden in such a state, 
k = poly{n, p).) Now, we can create a new state with stronger security properties using the map 



(27) 
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Here the quantum secret lives in subsystem "2", which is an A;-qubit multipartite Hilbert space 
distributed among the p parties 7iA2 ®T~(-B2® ^^02 • • •■ The dimensions of these local spaces need 
not be the same, since some parties may get larger shares of the secret than others. Each party also 
has a register of subsystem "1", comprising s qubits in total, which contains the data hiding state 
Pi, and which is capable of hiding the 2/c-bit string /. Note that, although the secret-sharing state 
if may only occupy a subspace of the "2" subsystem (as when it is a quantum error correcting 
code state), aj acts on the entire "2" Hilbert space, not just on the code subspace in which the 
quantum secret may be contained. 

As Eggeling and Werner have recently shown, there exist multipartite data-hiding states pi 
with any desired access structure, and with hiding security that is exponential in s/k [^. (Unlike 
the bipartite states used in Ref. however, these states are not orthogonal, just nearly so. This 
gives rise to a small probability of error when authorized sets reconstruct the secret but otherwise 
has no effect on the analysis for our purposes.) If we choose the access structure of the pj states 
and the quantum secret sharing states to be identical, then the quantum state can obviously still 
be reconstructed by quantum communication within an authorized set; first pj is measured to 
identify /, then the Pauli rotation o"/ is done by the authorized parties, so that they have the state 
if "in the clear", permitting them to reconstruct it by whatever operations the original quantum 
secret sharing protocol prescribed. Of course, it does not matter whether the Pauli rotations are 
done by the parties outside the authorized set, since these parts of the quantum state are not 
needed for the reconstruction anyway. 

In the rest of this section, we demonstrate the other part of the desired security of the protocol: 
an unauthorized set cannot reveal the quantum state even when all parties can perform LOCC 
and quantum communication can be performed within the unauthorized set. The proof relies on 
the fact, as in the bipartite case, that with these resources, the parties cannot decode the classical 
hiding states pj. 

So, we suppose that in the given "unauthorized" setting, the 2A;-bit hiding scheme is e-secure; 
we will show that the quantum-state hiding is guaranteed to be (5-secure, for 6 = e2^^^^. The first 



part of the demonstration closely follows the reasoning of Section |1I C\ We consider "cheating" 
operations = Tr' o L+, where is a member of the set of LOCC operations + quantum 
operations among members of the unauthorized set, and Tr' indicates a tracing out of all parties 
except one. We will also need the multipartite version of Eq. (§), Cf{T^) = C'^ip] ® r^). Given 
that the parties are supplied with the state p], Cf can be implemented with the same limited 
communication resources as can. We introduce ancilla subsystem "3", which has the same 
dimension and the same multipartite structure as subsystem "2". Each party locally creates a 
maximally entangled state $ between its part of system 2 and 3. Let us denote the tensor product 
of all these local maximally entangled states as a big maximally entangled state <I>^^. Then the 
parties can create the state 



0;/ = (£+®l3)(^''). (28) 



Now the proof begins by contradiction as in Section |II Q . suppose the qubit-hiding scheme 
is not (5-secure, meaning that there are secret sharing states ipo and ipi and a cheating operation 

such that Eq. ( |T6| ) is true. Then by following without change the analysis after Eq. (16), we 
conclude that there must exist a bit string / for which (cf. below Eq. (|2l|)) 

||u;/=o-w/||i = IIA/lli ><5/2'+^ (29) 

Unlike in the previous case, we cannot use this equation immediately to bound e and end the 
argument; the trace norm is only directly related to the distinguishability when any quantum 
operation can be done on the state. In this case loj is a state shared by all parties who can perform 
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LOCC operations and some additional quantum communication depending on the protocol. In 
other words, we can only bound the distinguishability e of the classical message by (see Eq. 



e > maxDist£+(u;/,a;x) > maxDist£^ocp(a;/, w^) = max max WCLOcdyJi) - Clocc{'^k)\\i- 

I,K I,K I,K Clocc 

(30) 

Here Distx denotes the distinguishability of two states under the set of operations X. We restrict 
to only LOCC operations here because we can use a known relationship between the LOCC dis- 
tinguishability of two states and their trace-norm distance, using the tomography arguments of 
Ref. Of course, this LOCC distinguishability may be very much less than — pre- 

cisely because of the data-hiding effect that is the subject of this paper, which sometimes prevents 
the distinguishability of states from being detectable by LOCC operations. The effect is never 
perfect, however, a fact which we now use. 

Suppose the states uoi are written as Eq. (105)] 

1^/ = ^ V! aijaj, (31) 

where d is the dimension of the space supporting uoj. The "3" register in Eq. (H) supports k 
qubits whereas the map Cj can be taken to output a single qubit [|l3|]. Therefore, d = 2^^^. Then 
Appendix B of Ref. [|, Eq. (110)] shows that 

1 

T)ist LOG I, ^k) > - max |a/j - aKj\. (32) 



We apply a chain of inequalities: 



- '^ii'lli ^ 3 X] "("^^■^ ~ aKj)crj\\i < ;^ ^ ll«/J - Oi^jlli lkj||i 



d ^ d 

J J 



^ |a/j - aKj\ < d^ max |a/j - aKj\- (33) 



J 
J 



We have used = d. Note also that there are d terms in the J-sum. Combining (|30D, ([32|) 



and (33): 



e > 7r^||u;/=o - (34) 



2(i2 

So, combining this with Eq. (|29|), we find that 

5 _ 5 

But since the classical hiding can be chosen such that e = cil^^'^^/^, there is always a choice of 
s that will guarantee that 6 is as small as desired. So, at the price of a worse bound (but only 
polynomially worse), we prove security of the multipartite case. 



IV. HOW MANY CLASSICAL BITS ARE NEEDED IN QUANTUM HIDING 



In the previous sections we have seen that any 2n-bit hiding scheme can be used to construct an 
n-qubit hiding scheme and vice-versa. This duality has immediate implications for the resource 
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requirements of quantum data hiding schemes. In particular, suppose that {p/} is a set of perfectly 
secure hiding states for the string /, representing k bits of data and that 

I 

where Tj is a TCP map and 93 is an n-qubit state. We do not know whether all n-qubit hiding 
schemes will have this form but it is a significant generalization of the construction we described 
in section ||. We will show that in order for this to be a secure qubit hiding scheme k > 2n. 

Let us assume that this provides a perfectly secure n-qubit hiding scheme for ip, and use the 
encoding Eg to hide bits by means of our superdense coding construction. We will get a secure 
2n-bit hiding scheme by applying E'g (g) I to the appropriate maximally entangled states. We could 
interpret this construction as a way of hiding a message of 2n bits by means of a key I of k 
bits. We will now prove that this implies that k > 2n, using an argument nearly identical to the 
one Shannon used to show that one-time pad encryption of a 2n-bit message requires 2n shared 
random key bits [|ll|]. The only difference here is that we substitute quantum entropy functions 
for their classical counterparts and then have to verify in a couple of places that these quantum 
functions are nonnegative, a property guaranteed for their classical versions. For definitions of 
the functions we use below, see, for example, Ref. [p^]. 

Consider the density operator 

Y,Pm\m){m\^' mf pf"' {Tj ® I)(|$„)(cl>„|)^^^3. (37) 

m,I 

Here M is a register storing the message m, K a register storing the key / and the set {'&m} 
is a set of mutually orthogonal maximally entangled states. Because the message and key are 
independent, S{M : K) = 0. Likewise, because the bit-hiding scheme is perfectly secure, S{M : 
^2^3) = 0. Once the key is known, however, the classical message can be reconstructed from 
register B2B3 so that 

S{M : B2Bs\K) = S{M : K\B2B^) = S{M). (38) 

Equivalently, S{K\B2B:i) - S{K\B2B-iM) = S{M). Because the multipartite density operator is 
separable across the M/K/AB1/B2B3 cuts, S{K\B2B3M) > 0, and we can conclude that S{K) > 
S{M). In particular, applying this inequality for the uniform distribution over 2n bit messages 
yields k > 2n. Our conclusion is that if an n-qubit hiding scheme is constructed from a A;-bit 
hiding scheme in the manner of Eq. ( p6| ) then k, the number of bits, must be at least twice the 
number of qubits being hidden. 

These arguments can also be applied to the case of a private quantum channel. In this scenario, 
the analog of an A;-bit hiding scheme is just k secret random bits shared between two parties Alice 
and Bob. A general private quantum channel then has the form 

I 

where T/ is a general TCP map with output on the channel system C. The requirements for 
the task are that, using their access to /, Bob (or Alice) can reconstruct ip but an eavesdropper 
with access only to the channel C can learn nothing. Assume that one can encrypt an n-qubit 
quantum state (p m this manner. Such a private quantum channel can be converted into a secure 
2ra-bit one-time pad using the superdense coding construction of section |I1B| - the proof goes 
through unchanged. Likewise, the resource considerations developed above imply that k > 2n 
bits of shared secret key are necessary and sufficient to build the n-qubit private quantum channel, 
confirming the main result of Refs. [||] and [^. 
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V. DISCUSSION AND CONCLUSIONS 

Our main goal in this paper was to show how the duaHty between superdense coding and 
teleportation can be used to construct new cryptographic protocols. From a constructive point 
of view, our main results are a protocol for hiding qubits given a protocol for hiding twice as 
many bits and a method for strengthening quantum secret sharing protocols such that they are 
not vulnerable to cheating by LOCC. 

In our analyses of imperfect hiding, however, we could only guarantee a quality of hiding 
decreasing exponentially in the number of qubits, or bits, being hidden. Because the quality 
typically improves exponentially with the size of the hiding state measured in qubits, our security 
proofs could still be useful. Nonetheless, it seems possible that a more careful analysis of the 
hiding quality of the new protocols would reveal that the exponential factor, in fact, disappears. 
We leave that possibility open for future work. 
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